Analyzing device-related data to generate and/or suppress device-related alerts

ABSTRACT

A device may receive data related to operations of a plurality of managed devices. The device may determine, after receiving the data, a multi-entity profile for the data. The device may determine, using the multi-entity profile, a set of sub-models for the data after determining the multi-entity profile. The set of sub-models may be associated with processing the data in a contextualized manner. The device may generate a model based on the set of sub-models. The device may perform one or more actions related to the plurality of managed devices or the at least one alert based on respective scores associated with the plurality of managed devices after generating the model.

BACKGROUND

An organization is associated with various devices that are used foroperations of the organization. A monitoring system monitors operationsof the various devices associated with the organization by collectingdata related to the operations of the various devices. The monitoringsystem tracks metrics associated with the operations based on the dataand generates alerts based on the metrics.

SUMMARY

According to some implementations, a method may comprise: receiving, bya device, an indication of at least one alert related to operations of aplurality of managed devices and data related to the operations of theplurality of managed devices, wherein the indication of the at least onealert is received from a monitoring system that is monitoring theoperations of the plurality of managed devices; determining, by thedevice and after receiving the data, a multi-entity profile for thedata, wherein the multi-entity profile includes a set of groupings ofthe data by one or more attributes of the plurality of managed devices;determining, by the device and using the multi-entity profile, a set ofsub-models for the data after determining the multi-entity profile,wherein at least one sub-model, of the set of sub-models, is associatedwith contextualizing the data to the plurality of managed devices;generating, by the device, a model based on the set of sub-models;determining, by the device and utilizing the model after generating themodel, respective scores for the plurality of managed devices, whereinthe respective scores are used to identify at least one of: one or morealerts, of the at least one alert, to suppress, or one or more manageddevices, of the plurality of managed devices, to replace; andperforming, by the device, one or more actions related to at least oneof the plurality of managed devices and the at least one alert afterdetermining the respective scores for the plurality of managed devices.

According to some implementations, a device may comprise: one or morememories; and one or more processors, communicatively coupled to the oneor more memories, to: receive at least one alert related to operationsof a plurality of managed devices and data related to the operations ofthe plurality of managed devices, wherein the at least one alert isreceived from a device monitoring system associated with the pluralityof managed devices, and wherein the data related to the operations isreceived from the plurality of managed devices; determine, afterreceiving the data, a multi-entity profile for the data based on one ormore attributes of the plurality of managed devices; determine, usingthe multi-entity profile, a set of sub-models for the data related tothe operations after determining the multi-entity profile, wherein theset of sub-models is associated with processing the data in acontextualized manner; generate a model based on the set of sub-models,wherein the model is associated with identifying at least one of: one ormore alerts, of the at least one alert, to suppress, or one or moremanaged devices, of the plurality of managed devices, to replace; andperform one or more actions related to the plurality of managed devicesor the at least one alert after determining respective scores for theoperations.

According to some implementations, a non-transitory computer-readablemedium may store instructions, the instructions comprising: one or moreinstructions that, when executed by one or more processors, cause theone or more processors to: receive data related to a plurality ofmanaged devices, wherein the data includes at least one of: diagnosticdata associated with operations of the plurality of managed devices,call dispatch data associated with respective service historiesassociated with the plurality of managed devices, or customer dataassociated with respective customers associated with the plurality ofmanaged devices; determine, after receiving the data, a multi-entityprofile for the data, wherein the multi-entity profile includes a set ofgroupings of the data by one or more attributes of the plurality ofmanaged devices; determine, using the multi-entity profile, a set ofsub-models for the data after determining the multi-entity profile,wherein the set of sub-models is associated with processing the data ina contextualized manner; generate a model based on the set ofsub-models; and perform, after generating the model, one or more actionsrelated to the plurality of managed devices based on respective scoresassociated with the plurality of managed devices.

BRIEF DESCRIPTION OF THE DRAWINGS

FIGS. 1A-4B are diagrams of example implementations described herein.

FIG. 5 is a diagram of an example environment in which systems and/ormethods described herein may be implemented.

FIG. 6 is a diagram of example components of one or more devices of FIG.5.

FIGS. 7-9 are flow charts of example processes for analyzingdevice-related data to generate and/or suppress device-related alerts.

DETAILED DESCRIPTION

The following detailed description of example implementations refers tothe accompanying drawings. The same reference numbers in differentdrawings may identify the same or similar elements.

An organization may be associated with various devices that are used foroperations of the organization. For example, the various devices mayinclude client devices (e.g., computers, mobile phones, and/or thelike), network devices (e.g., routers, modems, and/or the like), serverdevices, and/or the like. In some cases, the organization uses amonitoring system to monitor operations of the various devicesassociated with the organization. For example, the monitoring systemcollects data related to the operations of the various devices andanalyzes the data. The monitoring system tracks metrics associated withthe operations based on the data and generates alerts based on themetrics.

Alert generation by the monitoring system frequently relies on use ofstatic thresholds, where values for the metrics are compared to thestatic thresholds for determination of whether to generate an alert. Inaddition, alert generation by the monitoring system is notcontextualized to the various devices, such that the determination ofwhether to generate an alert is based on normal performance of thedevice, an age of the device, a performance of other devices associatedwith the same organization, and/or the like. This reduces an accuracy ofthe monitoring system's analysis of the data and results in asignificant percentage of generated alerts being false positive alerts.The false positive alerts cause delay with regard to addressing (e.g.,fixing, attempting to fix, documenting, and/or the like) an actual issuewith the various devices, consume significant computing resources of adevice that receives the false positive alerts, and/or the like. Inaddition, the false positive alerts consume a significant amount of timeand/or effort of network engineers for investigation of the falsepositive alerts by the network engineers and/or manual adjustment ofthresholds implemented by the monitoring system. Further, the falsepositive alerts cause true positive alerts to be missed, which can causedownstream issues as other systems and/or devices are impacted by actualissues associated with the true positive alerts.

Some implementations described herein provide a device analyticsplatform that receives data related to operations of various devicesassociated with an organization, and processes the data in acontextualized manner (e.g., using “big data” and/or machine learningtechniques) to determine whether to replace one or more of the variousdevices, to suppress an alert generated by a monitoring system that ismonitoring the operations of the various devices, and/or the like. Inthis way, the device analytics platform is capable of reducing oreliminating false positive alerts that are sent to an administrator ofthe various devices (e.g., to a server associated with theadministrator), while maintaining true positive alerts. This improves anaccuracy of generating alerts related to the operations of the variousdevices relative to a monitoring system, thereby conserving computingresources that would otherwise be consumed as a result of less accurategeneration of alerts. In addition, reducing or eliminating falsepositive alerts reduces or eliminates a delay associated with fixing anactual issue with one or more of the various devices that wouldotherwise occur as a result of the false positive alerts. Further, thisconserves computing resources that would otherwise be consumed as aresult of the false positive alerts being received by a deviceassociated with an administrator. Further, this reduces costs associatedwith managing a set of managed devices associated with an organizationby reducing or eliminating usage of organizational resources forinvestigation of false positive alerts. Further, this reduces oreliminates the occurrence of downstream issues to other devices and/orsystems that would otherwise result from a missed positive alert.

FIGS. 1A-1C are diagrams of an example implementation 100 describedherein. As shown in FIG. 1A, implementation 100 includes a set ofmanaged devices, a device monitoring system, and a device analyticsplatform. As shown in FIG. 1A, the set of managed devices may includevarious network devices, such as one or more routers, one or moremodems, and/or the like. In some implementations, the set of manageddevices may include a set of client devices, a set of server devices,and/or the like. In implementation 100, the device monitoring system ismonitoring the set of managed devices. For example, the devicemonitoring system may monitor operations of the set of managed devicesand may generate alerts based on tracking metrics related to theoperations of the set of managed devices.

As shown by reference number 102, the device analytics platform mayreceive operations data from the set of managed devices. For example,the device analytics platform may receive the operations data duringoperations of the set of managed devices, based on requesting theoperations data from the set of managed devices, in a streaming manner,in real-time or near real-time, from a monitoring system or a datacollection system that is between the device analytics platform and theset of managed devices and that monitors operations data from the set ofmanaged devices, and/or the like. In some implementations, theoperations data for a managed device may identify an input utilizationfor the managed device, an output utilization for the managed device, acentral processing unit (CPU) utilization of the managed device, ajitter of communications of the managed device, a quantity of tasksbeing performed by the managed device, a quantity of packets sent toand/or from the managed device, and/or the like. Additionally, oralternatively, the operations data may identify one or more attributesof a managed device, such as a type of the managed device (e.g., a typesuch as a router, a modem, a client device, a server device, and/or thelike), an age of the managed device, a location of the managed device, abrand of the managed device, a product line of the managed device (e.g.,associated with the same brand), and/or the like. In someimplementations, the operations data may be time-series data.

As shown by reference number 104, the device analytics platform mayreceive an alert from the device monitoring system. For example, thedevice analytics platform may receive the alert when the devicemonitoring system generates the alert based on tracking metricsassociated with the operations of the set of managed devices. In someimplementations, the alert may indicate that the device monitoringsystem has detected an issue with the operations of the set of manageddevices. For example, the device monitoring system may generate thealert based on detecting that a value for a metric has satisfied athreshold, is outside of a range of values, and/or the like.

As shown by reference number 106, the device analytics platform maydetermine a multi-entity profile for the operations data. For example,the device analytics platform may determine a multi-entity profile forthe operations data after receiving the operations data, after receivingthe alert, based on receiving input from a user of the device analyticsplatform to determine the multi-entity profile, and/or the like.Additionally, or alternatively, and continuing with the previousexample, the device analytics platform may determine a multi-entityprofile periodically, according to a schedule, as updated operationsdata is received from the set of managed devices, and/or the like. Inthis way, the device analytics platform may update a multi-entityprofile, thereby improving an accuracy of the multi-entity profileand/or an accuracy of operations of the device analytics platform thatuse the multi-entity profile.

In some implementations, a multi-entity profile may include a set ofgroupings of the operations data by a set of attributes included in theoperations data. For example, the multi-entity profile may organizeoperations data by managed device, by location (e.g., a location of amanaged device), by brand (e.g., a brand associated with a manageddevice), and/or the like. Continuing with the previous example, amulti-entity profile for a managed device may include data related tothe operations of the managed device, that identifies a location of themanaged device, that identifies a brand of the managed device, thatidentifies values for one or more metrics associated with the manageddevice, and/or the like.

In some implementations, the device analytics platform may organize theoperations data for the multi-entity profile based on unique identifiersincluded in the data (e.g., unique identifiers that uniquely identify amanaged device associated with the operations data, a locationassociated with the operations data and/or a managed device, a brandassociated with the operations data and/or a managed device, and/or thelike). In some implementations, the unique identifiers may be includedin the operations data as an attribute of the operations data (e.g., asa field with a unique value, such as a name, an identification number,and/or the like), and the device analytics platform may organize theoperations data based on the unique identifiers included as theattribute in the operations data.

Additionally, or alternatively, the device analytics platform mayprocess the operations data to identify the unique identifiers. Forexample, the device analytics platform may process the operations datausing a text processing technique, such as a natural language processingtechnique, a text analysis technique, and/or the like. Continuing withthe previous example, the device analytics platform may process the textto identify an alphanumeric string, a symbol, a code, and/or the likeincluded in the operations data (e.g., that indicates a presence of aunique identifier, that is a unique identifier, and/or the like), andmay identify a unique identifier included in the text by comparing thealphanumeric string, the symbol, the code, and/or the like toinformation stored in a data structure and/or in memory resources of thedevice analytics platform to determine which unique identifiers areincluded in the operations data.

Additionally, or alternatively, and as another example, the deviceanalytics platform may process the data using a model (e.g., a machinelearning model, an artificial intelligence model, and/or the like) toidentify a unique identifier included in the operations data. Forexample, the device analytics platform may use the model to process textto identify an alphanumeric string, a symbol, a code, and/or the likeincluded in the operations data (e.g., based on having been trained toidentify unique identifiers in the operations data).

In some implementations, the device analytics platform may portionoperations data from the set of managed devices into a training set, avalidation set, a test set, and/or the like. In some implementations,the device analytics platform may train a machine learning modeldescribed herein using, for example, a factorization machine, a randomforest, gradient boosting, a kernel density estimation (KDE) model,and/or the like, and based on the training set of the operations data.

In some implementations, the training set of data may be specific to amanaged device, to an attribute of the set of managed devices, and/orthe like. This provides more accurate detection of issues related tooperations of the set of managed devices. This provides the deviceanalytics platform with the capability to identify different issues, toidentify the same issue regardless of deviations in performance acrossthe set of managed devices, differences in attributes across the set ofmanaged devices, and/or the like included in the operations data.

In some implementations, training of the machine learning model mayinclude supervised training. For example, a user of the device analyticsplatform may manually classify operations data to train the machinelearning model. This may increase an accuracy of training of the machinelearning model and/or may reduce an amount of time needed to train themachine learning model.

In some implementations, the device analytics platform may use afactorization machine technique to train a machine learning model. Forexample, the factorization machine technique may train the machinelearning model on features included in a data set. Additionally, oralternatively, the device analytics platform may use a random foresttechnique to train a machine learning model. For example, the deviceanalytics platform may use the random forest technique to train themachine learning model by constructing multiple decision trees from theoperations data. Additionally, or alternatively, the device analyticsplatform may train the machine learning model using a gradient boostingtechnique. For example, the device analytics platform may use thegradient boosting technique to generate a prediction model based on adata set.

In some implementations, the device analytics platform may use alogistic regression classification technique to determine a categoricaloutcome (e.g., attributes included in operations data, metricsdetermined from the operations data, and/or the like). Additionally, oralternatively, the device analytics platform may use a naïve Bayesianclassifier technique. In this case, the device analytics platform mayperform binary recursive partitioning to split the operations data ofthe minimum feature set into partitions and/or branches, and may use thepartitions and/or branches to perform predictions (e.g., that theoperations data includes particular attributes, that the operations dataidentifies particular metrics, and/or the like). Based on usingrecursive partitioning, the device analytics platform may reduceutilization of computing resources relative to manual, linear sortingand analysis of data points, thereby enabling use of thousands,millions, or billions of data points to train a model, which may resultin a more accurate model than using fewer data points.

Additionally, or alternatively, the device analytics platform may use asupport vector machine (SVM) classifier technique to generate anon-linear boundary between data points in the training set. In thiscase, the non-linear boundary is used to classify test data (e.g.,operations data) into a particular class (e.g., a class associated witha particular set of attributes included in operations data, an issueincluded in operations data, and/or the like).

In some implementations, rather than training a model, the deviceanalytics platform may receive a model from another device (e.g., aserver device). For example, a server device may generate a model basedon having trained the model in a manner similar to that described aboveand may provide the model to the device analytics platform (e.g., maypre-load the device analytics platform with the model, may receive arequest from the device analytics platform for the model, and/or thelike). In some implementations, the device analytics platform mayperform a lookup to identify a model for operations data associated witha managed device. For example, the device analytics platform may performa lookup of a model associated with a managed device based on one ormore attributes of the managed device. In other words, the deviceanalytics platform may utilize various models to identify a set ofissues included in the operations data, thereby increasing an accuracyof identifying the set of issues.

Reference number 108 shows example multi-entity profiles that the deviceanalytics platform may generate. As shown, a multi-entity profile mayorganize the operations data that the device analytics platform receivedby type of device, by managed device, by location of a managed device,by age of a managed device, and/or the like. In this way, a multi-entityprofile facilitates quick and easy access to operations data in anorganized manner. This conserves processing resources of the deviceanalytics platform relative to not using a multi-entity profile,facilitates training of a model to identify issues in operations databased on attributes included in the operations data (e.g., the deviceanalytics platform may train the model on a particular type of device ordifferent types of devices generally, on a managed device or differentmanaged devices generally, and/or the like), thereby improving anaccuracy of the model with regard to identifying issues in operationsdata.

Turning to FIG. 1B, and as shown by reference number 110, the deviceanalytics platform may determine a set of metric sub-models. Forexample, the device analytics platform may determine a set of metricsub-models using the multi-entity profile, after determining themulti-entity profile, based on receiving input from a user of the deviceanalytics platform to determine the set of metric sub-models, accordingto a schedule, periodically, and/or the like. In some implementations,the device analytics platform may determine the metric sub-model basedon the multi-entity profile. For example, the device analytics platformmay use the multi-entity profile (e.g., the manner in which themulti-entity profile organizes the operations data) to determine the setof metric sub-models. Continuing with the previous example, the deviceanalytics platform may select, from the multi-entity profile, operationsdata associated with a managed device, operations data for a particulartime period, and/or the like to determine the set of metric sub-models.

In some implementations, a metric sub-model may identify a pattern, atrend, and/or the like for a set of metrics associated with operationsof a managed device. For example, the metric sub-model may identify apattern, a trend, and/or the like of the set of metrics over time, atparticular times of the day or days of the week, when the set of manageddevices is performing particular functions, and/or the like. In thisway, a metric sub-model may identify operational characteristics overtime of a managed device, thereby contextualizing the operations data tothe managed device. In some implementations, the device analyticsplatform may determine a single metric sub-model for a single manageddevice. This facilitates individual analysis of a managed device in thecontext of the managed device, thereby facilitating identification ofindividual issues with individual managed devices, even when the set ofmanaged devices includes hundreds, thousands, or more managed devices.In addition, this facilitates a contextualized analysis of a manageddevice based on unique patterns, trends, and/or the like of the set ofmetrics, thereby facilitating more accurate and/or individualizeddetection of issues across hundreds, thousands, or more managed devices,thereby reducing or eliminating false positive identification of anissue (and subsequent false positive alert generation), and/or the like.Further, this facilitates inter-metric analysis for individual manageddevices (e.g., an analysis of a manner in which different metrics arerelated to each other on an individual managed device basis), therebyimproving an analysis of the set of managed devices.

In some implementations, the device analytics platform may determine ametric sub-model based on a kernel density estimation (KDE) model. Forexample, the device analytics platform may determine a KDE model for aset of metrics associated with a managed device by processing values forthe set of metrics using a kernel parameter and a kernel bandwidthparameter. Reference number 112 shows an example of a KDE model that thedevice analytics platform may generate as a metric sub-model for amanaged device.

As shown by reference number 114, the device analytics platform maydetermine a set of device sub-models. For example, the device analyticsplatform may determine the set of device sub-models after, or inassociation with, determining the set of metric sub-models, based onreceiving input from a user of the device analytics platform todetermine the set of device sub-models, after determining themulti-entity profile, and/or the like. In some implementations, thedevice analytics platform may determine the device sub-model based onthe multi-entity profile. For example, the device analytics platform mayuse the multi-entity profile (e.g., the manner in which the multi-entityprofile organizes the operations data) to determine the set of devicesub-models. Continuing with the previous example, the device analyticsplatform may select, from the multi-entity profile, data associated witha managed device, data that identifies one or more attributes associatedwith the set of managed devices, and/or the like.

In some implementations, a device sub-model may identify a pattern, atrend, and/or the like for a set of attributes associated with a manageddevice, similar to a metric sub-model described elsewhere herein. Inthis way, a device sub-model may identify operational characteristicsover time of an attribute, thereby contextualizing the operations datato the attribute. In some implementations, the device analytics platformmay determine a single device sub-model for a single attribute, similarto a metric sub-model.

In some implementations, when determining the set of device sub-models,the device analytics platform may group the set of managed devices basedon one or more attributes of the set of managed devices (e.g., may groupinformation identifying the set of managed devices based on informationidentifying one or more attributes of the set of managed devices). Forexample, the device analytics platform may group the set of manageddevices by type of managed device, by age, by brand of managed device,and/or the like. In some implementations, and continuing with theprevious example, the device analytics platform may use the operationsdata for different groupings of managed devices to determine a pattern,a trend, and/or the like for the different groupings of managed devices(e.g., for different attributes of the set of managed devices). Thisfacilitates attribute-specific analysis of operations of the set ofmanaged devices, which improves an accuracy of identifying an issue witha managed device, facilitates an analysis of the operations that iscontextualized to the attributes, reduces or eliminates false positiveidentification of issues, and/or the like.

Additionally, or alternatively, when determining the set of devicesub-models, the device analytics platform may generate a multivariatemetric model for the set of managed devices. For example, the deviceanalytics platform may generate a multivariate model that usesmultivariate analysis of variance, multivariate regression, factoranalysis, canonical correlation analysis, and/or the like to analyzeoperations data for multiple attributes of the set of managed devices,such as to identify relationships between the multiple attributes. Thisfacilitates multiple attribute analysis of operations of the set ofmanaged devices, which improves an accuracy of identifying an issue witha managed device, facilitates an analysis of the operations that iscontextualized to the multiple attributes, reduces or eliminates falsepositive identification of issues, and/or the like when manual review isnot otherwise possible due to the quantity of relationships betweenmultiple variables, due to the complexity of the relationships betweenmultiple variables, and/or the like. For example, generating amultivariate metric model may facilitate event correlation (e.g., issueidentification across attributes, across managed devices, and/or thelike), sequential pattern analyses, device performance analysis, failureprediction, and/or the like for hundreds, thousands, or more attributes.Reference number 116 shows various visualizations of examples of devicesub-models that the device analytics platform may determine (discussedbelow with respect to FIGS. 3A-3C). For example, the various examplesmay identify values for the set of managed devices for multipleattributes of the set of managed devices, as described elsewhere herein.

Turning to FIG. 1C, and as shown by reference number 118, the deviceanalytics platform may generate a model for the set of metric sub-modelsand the set of device sub-models. For example, the device analyticsplatform may generate a model for the set of metric sub-models and theset of device sub-models after determining the set of metric sub-modelsand/or the set of device sub-models, based on receiving input from auser of the device analytics platform to generate the model, and/or thelike. In some implementations, the model may include an isolation forest(e.g., where the operations data is partitioned into randomly selectedfeatures and then minimum and maximum values of each feature areselected), a neural network (e.g., where nodes of the neural network aretrained and are used to process the operations data), and/or the likethat can be used to process the operations data to identify an issuewith the operations of the set of managed devices, to determine whetheran alert from the device monitoring system is to be suppressed, todetermine whether one or more managed devices of the set of manageddevices needs to be replaced, and/or the like, as described elsewhereherein.

In some implementations, the device analytics platform may use multipletypes of models and may use a combination of unsupervised and supervisedmachine learning techniques. For example, the device analytics platformmay use an isolation forest for unsupervised machine learning and mayuse a neural network for supervised machine learning. The combination ofsupervised and unsupervised machine learning may compensate formisalignment between operations data and alerts received from the devicemanagement system. For example, the device analytics platform may havedifficulty aligning operations data with received alerts from the devicemanagement system based on a delay between receiving the operations dataand/or the alerts, inaccuracies in time stamps associated with theoperations data and the alerts, and/or the like, and the combination ofunsupervised and supervised machine learning may compensate for theseissues. In this way, the combination may improve an accuracy of traininga machine learning model associated with the device analytics platform.

As shown by reference number 120, the device analytics platform maygenerate the model based on combining the set of metric sub-models andthe set of device sub-models into the model. For example, the deviceanalytics platform may combine a set of KDE models, a set of groupingsof the set of managed devices, and/or a set of multivariate models intothe isolation forest, the neural network, and/or the like.

In some implementations, the device analytics platform may generate themodel by training a machine learning model on the set of metricsub-models and/or the set of device sub-models. In some implementations,the device analytics platform may train the machine learning model usingthe model. The machine learning model may, for example, be similar tothat described elsewhere herein.

In some implementations, the device analytics platform may re-train themodel based on receiving updated operations data. For example, thedevice analytics platform may re-train the model in real-time or nearreal-time (e.g., as the device analytics platform receives updatedoperations data), periodically, according to a schedule, and/or thelike.

As shown by reference number 122, the device analytics platform maydetermine a score based on output from the model. For example, thedevice analytics platform may determine a score for a managed device,for operations of the managed device, and/or the like after generatingthe model, after processing the operations data using the model, and/orthe like.

In some implementations, the device analytics platform may determine aseparate score for different managed devices, may determine a separatescore for different attributes of the set of managed devices, maydetermine an aggregated score for multiple managed devices (e.g., byattribute, by time period, and/or the like), for multiple attributes(e.g., by time period), and/or the like. In some implementations, adevice analytics platform may determine an aggregated score by summingmultiple scores, averaging multiple scores, applying weights todifferent scores, and/or the like.

In some implementations, a score may indicate a quality of operations ofa managed device (or of multiple managed devices for an aggregatedscore). For example, a score may indicate whether a managed device isexperiencing an issue with operations of the managed device, whether analert from the device monitoring system needs to be suppressed, whethera managed device (or a group of managed devices) needs to be replaced,and/or the like.

In some implementations, to determine the score, the device analyticsplatform may process operations data using the model. For example, themodel may process the operations data for a managed device to identifyanomalies in the operations data for the managed device (e.g.,operations data that satisfies a threshold, that is outside of anexpected range, and/or the like) based on historical patterns, trends,and/or the like for the managed device, for particular times of the dayor days of the week, for particular functions that the managed device isperforming, by attribute of the managed device, and/or the like.

As shown by reference number 124, the model may output the score afterthe device analytics platform has processed the operations data usingthe model. Additionally, or alternatively, when the device analyticsplatform processes the operations data using a machine learning model,the machine learning model may output the score. In someimplementations, the score may be an average score, a range of scores,and/or the like. For example, the device analytics platform may performmultiple iterations of processing of the operations data and maygenerate the score based on the scores associated with the multipleiterations.

In some implementations, the device analytics platform may re-determineand/or re-train the set of metric sub-models, the set of devicesub-models, the model, and/or the like based on receiving updatedoperations data from the set of managed devices and/or new alerts fromthe device monitoring system. For example, the device analytics platformmay re-determine and/or re-train the set of metric sub-models, the setof device sub-models, the model, and/or the like in a manner similar todetermining and/or training the set of metric sub-models, the set ofdevice sub-models, the model, and/or the like described elsewhereherein. This improves an accuracy of processing operations data overtime as operations data changes, as the device monitoring system isupdated to generate alerts in new ways, and/or the like.

As shown by reference number 126, the device analytics platform mayperform an action related to suppressing an alert and/or replacing amanaged device based on the score. For example, the device analyticsplatform may perform the action after determining the score, afterprocessing the operations data using the model, based on receiving inputfrom a user of the device analytics platform to perform the action,and/or the like.

In some implementations, the device analytics platform may determine aquality of a managed device based on a score for the managed device. Forexample, the device analytics platform may determine whether theoperations of the managed device include an issue, include an issue of athreshold severity (e.g., based on using information that maps variouspossible issues in the operations data to a corresponding severity),and/or the like based on the score. Additionally, or alternatively, andas another example, the device analytics platform may perform atime-series analysis of scores for the operations over time to determinewhether a pattern, a trend, and/or the like of the scores indicates anissue.

In some implementations, the device analytics platform may generate arecommendation related to one or more managed devices of the set ofmanaged devices and/or related to one or more alerts generated by thedevice monitoring system based on the score. For example, the deviceanalytics platform may generate a recommendation to replace the one ormore managed devices, to power down the one or more managed devices, topower on one or more additional managed devices, and/or the like.Additionally, or alternatively, and as another example, the deviceanalytics platform may generate a recommendation to suppress an alert,to assign an alert a particular priority (e.g., a high priority, amedium priority, or a low priority), to direct the alert to a particularindividual associated with the organization (e.g., to a device or anaccount associated with the individual), such as based on the priorityof the alert, and/or the like.

In some implementations, the device analytics platform may generate awork order based on the score and may provide the work order to a deviceand/or an account associated with an individual. For example, the deviceanalytics platform may generate a work order to repair and/or to replaceone or more managed devices of the set of managed devices. Additionally,or alternatively, the device analytics platform may send a set ofinstructions to the one or more managed devices to power down.Additionally, or alternatively, the device analytics platform may send aset of instructions to one or more other managed devices to power onand/or to boot up. Additionally, or alternatively, the device analyticsplatform may cause software updates or new software to be downloadedand/or installed on one or more of the managed devices.

In some implementations, the device analytics platform may prevent oneor more alerts from being sent to an intended destination (e.g., adevice and/or an account associated with a network technician and/or anadministrator). For example, the device analytics platform may be anintermediary between the device monitoring system and the intendeddestination and may suppress the one or more alerts from being sent tothe intended destination. Additionally, or alternatively, the deviceanalytics platform may send one or more alerts (or allow one or morealerts to be sent) to an intended destination. Additionally, oralternatively, the device analytics platform may generate a log ofwhether an alert was sent to an intended destination (e.g., in a datastructure that includes information that identifies the alert, atimestamp for the alert and/or suppression of the alert, and/or thelike).

Additionally, or alternatively, the device analytics platform may send aset of instructions to the device monitoring system to modify a mannerin which the device monitoring system generates alerts. For example, thedevice analytics platform may send a set of instructions to modify oneor more thresholds used by the device monitoring system, to modifymetrics that the device monitoring system uses to track operations ofthe set of managed devices, to modify a manner in which alerts from thedevice monitoring system are triggered (e.g., may modify an amount oftime that the device monitoring system has to detect an issue beforegenerating an alert), and/or the like.

In this way, the device analytics platform may reduce or eliminate falsepositive alert generation related to operations of a set of manageddevices, may facilitate replacement of one or more managed devices ofthe set of managed devices, and/or the like. This improves detectionand/or fixing of issues in operations of the set of managed devices,thereby reducing or eliminating delay related to detection and/or fixingof the issues. In addition, this reduces or eliminates false positivealert generation, thereby conserving computing resources that wouldotherwise be consumed as a result of the false positive alertgeneration. Further, this improves functioning of a set of manageddevices associated with an organization, thereby improvingcommunications via the set of managed devices. Moreover, thisfacilitates more efficient prioritization of managed devices forreplacement and/or updating relative to other techniques.

As indicated above, FIGS. 1A-1C are provided merely as an example. Otherexamples may differ from what was described with regard to FIGS. 1A-1C.Although some implementations were described as using particular typesof models, such as a KDE model, a neural network, and/or the like, theimplementations apply equally to other types of models, such as ak-means clustering model, a random forest model, and/or the like.

FIG. 2 is a diagram of an example implementation 200 described herein.As shown in FIG. 2, implementation 200 includes a device analyticsplatform. As shown by reference number 210, the device analyticsplatform may receive operations data related to operations of a set ofmanaged devices. Additionally, or alternatively, and as further shown byreference number 210, the device analytics platform may receive deviceattribute data related to a set of attributes of the set of manageddevices. In some implementations, the device analytics platform mayreceive the operations data and/or the device attribute data in a mannerthat is the same as or similar to that described elsewhere herein.

As shown by reference number 220, the device analytics platform maydetermine a multi-entity profile for the operations data and/or thedevice attribute data. For example, the device analytics platform maydetermine the multi-entity profile after receiving the operations dataand/or the device attribute data in a manner that is the same as orsimilar to that described elsewhere herein. In some implementations, thedevice analytics platform may determine a multi-entity profile based onthe operations data, such as by grouping the operations data by manageddevice, by time period, by metric, and/or the like. Additionally, oralternatively, the device analytics platform may determine amulti-entity profile based on the device attribute data, such as bygrouping the device attribute data by managed device, by attribute, bytime period, and/or the like.

As shown by reference number 230, the device analytics platform maydetermine a set of metric sub-models and a set of device sub-models. Forexample, the device analytics platform may determine the set of metricsub-models and/or the set of device sub-models after determining themulti-entity profile in a manner that is the same as or similar to thatdescribed elsewhere herein. In some implementations, the deviceanalytics platform may determine the set of metric sub-models based onthe operations data and/or the device attribute data. Additionally, oralternatively, the device analytics platform may determine the set ofdevice sub-models based on the operations data and/or the deviceattribute data.

As shown by reference number 240, the device analytics platform maygenerate a model. For example, the device analytics platform maygenerate a model based on the set of metric sub-models and/or the set ofdevice sub-models after generating the set of metric sub-models and/orthe set of device sub-models in a manner that is the same as or similarto that described elsewhere herein. In some implementations, the deviceanalytics platform may generate an isolation forest based on the set ofmetric sub-models and/or the set of device sub-models (e.g., bygenerating decision trees of the isolation forest from the set of metricsub-models and/or the set of device sub-models), may generate a neuralnetwork based on the set of metric sub-models and/or the set of devicesub-models (e.g., may train nodes of the neural network on the set ofmetric sub-models and/or the set of device sub-models), and/or the like.

As shown by reference number 250, the device analytics platform mayperform one or more actions related to output from the model. Forexample, the device analytics platform may perform one or more actionsrelated to alert suppression. Continuing with the previous example, thedevice analytics platform may prevent an alert generated by a devicemonitoring system from being sent to an intended destination.Additionally, or alternatively, and as another example, the deviceanalytics platform may perform one or more actions related to devicereplacement. Continuing with the previous example, the device analyticsplatform may generate a work order to replace one or more manageddevices of the set of managed devices.

FIG. 2 is provided merely as an example. Other examples may differ fromwhat was described with regard to FIG. 2.

FIGS. 3A-3C are diagrams of one or more example implementations 300described herein. FIGS. 3A-3C shows various example analyses that adevice analytics platform may perform and/or models that the deviceanalytics platform may generate.

FIG. 3A shows a plot 310 of a percent utilization (e.g., an inpututilization, an output utilization, a CPU utilization, and/or the like)of a managed device over time. In some implementations, the deviceanalytics platform may perform an analysis of data shown in plot 310,such as to determine whether to suppress an alert, whether to replace amanaged device, and/or the like. In some implementations, the deviceanalytics platform may perform the analysis in a contextualized manner,such as based on attributes of the managed device, based on historicaloperations of the managed device, and/or the like. As shown by referencenumber 320, the device analytics platform may suppress or not suppressvarious alerts associated with operations of the managed device. Forexample, the alerts may be associated with abnormal utilization of themanaged device.

In some implementations, the device analytics platform may use the datashown in FIG. 3A to perform an analysis of the alerts based on dynamicthresholding. For example, the device analytics platform may perform ananalysis of data that triggered an alert in the context of other dataassociated with a managed device, such as to determine whether the dataat the time the alert was generated is abnormal in the context of dataat other times around the time the alert was generated.

FIG. 3B shows a plot 330 of a comparison of an input utilization and anoutput utilization of a managed device (e.g., a percent utilization ofthe input utilization and of the output utilization) over time. In someimplementations, the device analytics platform may use the data shown inplot 330 to generate a device sub-model, such as a multivariate model.In some implementations, the device analytics platform may utilize thedata shown in plot 330 to prioritize alerts generated by the devicemonitoring system (e.g., a prioritization for analyzing the alerts, foraddressing the alerts, and/or the like).

FIG. 3C shows a plot 340 of an output utilization versus an inpututilization of multiple managed devices. For example, the deviceanalytics platform may use the data (e.g., percent utilization in termsof the output utilization versus the input utilization) shown in plot340 to determine a correlation between the output utilization and theinput utilization, such as to model a relationship between the outpututilization and the input utilization. In some implementations, thedevice analytics platform may use the data shown in plot 340 for amultivariate analysis, a high density KDE, a principle componentanalysis, and/or the like.

Although FIGS. 3A-3C are described in the context of particular metrics,the implementations apply similarly to other metrics described herein.

FIGS. 3A-3C are provided merely as an example. Other examples may differfrom what was described with regard to FIG. 3A-3C.

FIGS. 4A-4B are diagrams of one or more example implementations 400described herein. FIG. 4A shows an example of processing data related toa set of devices to identify one or more problematic devices and/or topredict a likelihood of the one or more devices needing to be serviced.As shown in FIG. 4A, implementation 400 includes a set of modems (orother network devices), a customer service network, and a deviceanalytics platform.

As shown by reference number 405, the device analytics platform mayreceive modem diagnostic data. For example, the device analyticsplatform may receive the modem diagnostic data from the set of modemsperiodically, according to a schedule, based on requesting the modemdiagnostic data from the set of modems, in real-time or near real-time,and/or the like. In some implementations, the modem diagnostic data mayidentify uptime for the set of modems, a data rate of the set of modems,a bandwidth used by the set of modems, and/or the like. Additionally, oralternatively, and as another example, the modem diagnostic data mayinclude operations data similar to that described elsewhere herein. Forexample, the modem diagnostic data may identify metrics related tooperations of the set of modems, attributes of the set of modems, and/orthe like.

As shown by reference number 410, the device analytics platform mayreceive call dispatch data and/or customer data. For example, the deviceanalytics platform may receive the call dispatch data and/or thecustomer data in association with receiving the modem diagnostic data,periodically, according to a schedule, based on requesting the calldispatch and/or customer data from the customer service network, inreal-time or near real-time, and/or the like. In some implementations,the call dispatch data may identify historical issues for the set ofmodems, solutions for the historical issues, service histories for theset of modems, and/or the like associated with various customers (e.g.,may include call data related to service calls, dispatch data related toservice dispatches, and/or a combination of call data and dispatchdata). In some implementations, the customer data may identify alocation of a customer, a service level associated with a customer, avalue of products and/or services purchased by a customer, a quantity oftimes that a customer has contacted a customer service departmentassociated with the set of modems for the same issue and/or fordifferent issues, issues that a customer has reported to a customerservice department, and/or the like.

Additionally, or alternatively, the modem diagnostic data, the calldispatch data, and/or the customer data may include session call datathat identifies a log of customer calls during a time period (e.g., thatincludes a subscriber identifier that identifies a customer associatedwith a customer call, information that identifies a date and/or time fora customer call, information that identifies a call duration of acustomer call, information that identifies a call reason for a customercall, and/or the like). Additionally, or alternatively, the modemdiagnostic data, the call dispatch data, and/or the customer data mayinclude data that identifies a log of dispatches for a time period(e.g., the same time period as the session call data), that identifiesinformation about whether a dispatch is productive (e.g., resolves anissue), and/or the like. Additionally, or alternatively, the modemdiagnostic data, the call dispatch data, and/or the customer data mayinclude subscriber data that identifies information for a subscriber ata particular time, that can be used to determine a customer churn date(e.g., a service disconnection date), and/or the like. Additionally, oralternatively, the modem diagnostic data, the call dispatch data, and/orthe customer data may include modem master data that identifies a deviceidentifier for a modem, a type of a modem, a subscriber identifierassociated with a modem, and/or the like.

As shown by reference number 415, the device analytics platform mayprocess data using a set of models. For example, the device analyticsplatform may process the modem diagnostic data, the call dispatch data,and/or the customer data using a set of models after receiving the modemdiagnostic data, the call dispatch data, and/or the customer data, basedon receiving input from a user of the device analytics platform, and/orthe like. In some implementations, the device analytics platform mayprocess the data using a set of models similar to that describedelsewhere herein (e.g., a set of metric sub-models, a set of devicesub-models, a model generated from the set of metric sub-models and/orthe set of device sub-models, and/or the like).

As shown by reference number 420, the device analytics platform mayidentify problematic modems, of the set of modems, and/or may predict alikelihood of a service request for one or more modems of the set ofmodems. For example, the device analytics platform may identifyproblematic modems and/or may predict a likelihood of a service requestfor the set of modems after processing the data using the set of models,based on receiving input from a user of the device analytics platform,and/or the like.

In some implementations, the device analytics platform may determinerespective scores for the set of modems based on output from the set ofmodels in a manner similar to that described elsewhere herein. Forexample, a score may identify a quality of operations of a modem, whichmay indicate that the modem is a problematic modem, may identify alikelihood that a modem will need a service request, a severity of anissue associated with a modem, a likelihood that a modem will need aservice request within a particular amount of time, and/or the like.

In some implementations, the device analytics platform may identifyproblematic modems of the set of modems based on the respective scores.For example, the device analytics platform may identify problematicmodems based on whether the respective scores satisfy a threshold,whether the respective scores are within a range of values, a pattern ofthe respective scores over time, a trend of the respective scores overtime, and/or the like. In some implementations, the device analyticsplatform may predict a likelihood of a service request for the set ofmodems in a similar manner.

As shown by reference number 425, the device analytics platform mayperform one or more actions. In some implementations, the deviceanalytics platform may receive a service request telephone call relatedto a modem (e.g., a telephone number associated with the service requesttelephone call may be associated with the modem, account informationand/or a modem identifier may have been input to a telephone associatedwith the service request telephone call, and/or the like) and maydetermine a priority for the service request telephone call based on ascore for the modem. For example, the score may indicate a likelihood ofthe modem needing to be serviced and/or whether the modem is aproblematic modem, and the device analytics platform may determine apriority for the service request telephone call based on the score(e.g., a high priority, a medium priority, or a low priority).

In some implementations, the device analytics platform may transfer,based on the priority, the service request telephone call to a telephoneassociated with a customer service representative, an interactive voiceresponse (IVR) system, and/or the like. For example, the deviceanalytics platform may transfer a high priority service requesttelephone call to the telephone, may transfer a medium priority servicerequest telephone call to the IVR system, may cause a recorded messagedirecting an individual associated with a low priority service requestcall to a web portal, and/or the like. In some implementations, thedevice analytics platform may send a message to a network technician, oranother individual (e.g., to a device or an account associated with thenetwork technician), to dispatch the network technician to a location ofa modem associated with a service request telephone call, based on thepriority. For example, the device analytics platform may send a message,such as a work order, to the network technician based on the priority.

In some implementations, the device analytics platform may senddifferent messages for different priority service request telephonecalls. For example, the device analytics platform may send a messageconfigured to cause a pop-up notification to be displayed on a displayassociated with a device associated with the network technician for ahigh priority service request telephone call, may send a message that isadded to an account inbox for a medium priority or a low priorityservice request call, and/or the like. In some implementations, thedevice analytics platform may schedule a servicing for the modem. Forexample, the device analytics platform may access electronic calendarsassociated with an individual associated with the modem and a networktechnician to identify an available time for the servicing and maygenerate a calendar item (e.g., a calendar meeting, a calendar event,and/or the like) on the electronic calendars for the servicing.

This improves an efficiency of managing incoming service requesttelephone calls via efficient and/or accurate prioritization of theincoming service request telephone calls. In addition, this reducescosts associated with servicing incoming service request telephonecalls. Further, this reduces a quantity of dispatches related to servicerequests, thereby conserving time, costs, fuel (e.g., of a vehicle),and/or the like, that would otherwise be consumed dispatching atechnician to a service request. Further, this improves a customersatisfaction and/or reduces or eliminates repeat service requesttelephone calls via efficient and/or accurate prioritization of servicerequest telephone calls.

FIG. 4B shows another example of processing data related to a set ofdevices to identify one or more problematic devices and/or to predict alikelihood of one or more devices needing to be serviced. As shown byreference number 430, the device analytics platform may receive modemdiagnostic data, dispatch data, and/or customer data. In someimplementations, the modem diagnostic data, dispatch data, and/orcustomer data may be similar to that described elsewhere herein and thedevice analytics platform may receive the modem diagnostic data,dispatch data, and/or customer data in a manner that is similar to thatdescribed elsewhere herein.

As shown by reference number 435, the device analytics platform maydetermine a multi-entity profile for the modem diagnostic data, dispatchdata, and/or customer data. In some implementations, the deviceanalytics platform may determine the multi-entity profile in a mannerthat is similar to that described elsewhere herein. In someimplementations, the multi-entity profile may be stored in a datastructure that stores the modem diagnostic data, dispatch data, and/orcustomer data organized in the manner described elsewhere herein. Insome implementations, the multi-entity profile may be updated in thedata structure and/or obtained from the data structure in real-time ornear real-time, in batch, and/or the like. In some implementations, themanner in which the multi-entity profile is stored may facilitatedetermination of metrics from the modem diagnostic data, dispatch data,and/or customer data, identification of features and/or patterns in themodem diagnostic data, dispatch data, and/or customer data, use ofprobabilities, statistics, hypothesis testing, and/or the like withregard to the modem diagnostic data, dispatch data, and/or customerdata, and/or the like.

As shown by reference number 440, the device analytics platform mayinclude a set of intra-modem sub-models and a set of inter-modemsub-models, such as to process the multi-entity profile. For example,the set of intra-modem sub-models and the set of inter-modem sub-modelsmay be similar to other models described elsewhere herein.

In some implementations, the set of intra-modem sub-models may berelated to analyzing data related to a specific modem, such as todetermine features of the data related to the modem, to determinerelationships among various metrics determined from the data, and/or thelike. For example, the set of intra-modem sub-models may include a KDEmodel similar to that described elsewhere herein. Continuing with theprevious example, the KDE model may include a non-parametric model toestimate a probability distribution for a metric. Additionally, oralternatively, and as another example, the set of intra-modem sub-modelsmay include a neural network similar to that described elsewhere herein.Continuing with the previous example, the neural network may combineand/or process features of the modem diagnostic data, dispatch data,and/or customer data, may analyze non-linear relationships among themodem diagnostic data, dispatch data, and/or customer data, and/oroutput a score (as described elsewhere herein).

In some implementations, the set of inter-modem sub-models may berelated to grouping different modems by modem diagnostic data, dispatchdata, and/or customer data, identifying anomalies among groups ofmodems, and/or the like. For example, the set of inter-modem sub-modelsmay include a k-means clustering model to group modems based on metricsdetermined from the modem diagnostic data, dispatch data, and/orcustomer data. Additionally, or alternatively, and as another example,the set of inter-modem sub-models may include an isolation forest modelsimilar to that described elsewhere herein. Continuing with the previousexample, the isolation forest model may be related to detectinganomalies and/or outliers in modem operation.

As shown by reference number 445, the device analytics platform mayinclude a model that is trained on and/or combines outputs of the set ofintra-modem sub-models and the set of inter-modem sub-models, such as todetermine a score similar to that described elsewhere herein. Forexample, the model may include a random forest model, a neural networkmodel, and/or the like. As shown by reference number 450, the deviceanalytics platform may output a call probability score (e.g., thatidentifies a likelihood of a modem being associated with a servicecall), a reason for a service call (e.g., a likely reason for theservice call), a dispatch probability score (e.g., that identifies alikelihood that a technician will need to be dispatched to a location ofthe modem), a non-productive dispatch (NPD) probability score (e.g.,that identifies a likelihood that the dispatched technician will beunsuccessful in resolving an issue that prompted the service call),and/or the like.

In this way, the device analytics platform provides a tool that can beused to easily and quickly utilize big data and/or machine learningtechniques in day-to-day operations of an organization. This increases ausability of big data and/or machine learning techniques relative to notusing the device analytics platform. In addition, this facilitates useof big data and/or machine learning techniques in real-time or nearreal-time, for batch processing, and/or the like.

FIGS. 4A-4B are provided merely as an example. Other examples may differfrom what was described with regard to FIGS. 4A-4B. For example,although FIGS. 4A-4B were described in the context of a set of modems,the implementations apply equally to other types of devices, such asother network devices (e.g., routers), client devices, server devices,and/or the like.

FIG. 5 is a diagram of an example environment 500 in which systemsand/or methods described herein may be implemented. As shown in FIG. 5,environment 500 may include a client device 510, a server device 520, adevice analytics platform 530 hosted within a cloud computingenvironment 532 that includes a set of computing resources 534, and anetwork 550. Devices of environment 500 may interconnect via wiredconnections, wireless connections, or a combination of wired andwireless connections.

Client device 510 includes one or more devices capable of receiving,generating, storing, processing, and/or providing data associated withoperations of a managed device. For example, client device 510 mayinclude a mobile phone (e.g., a smart phone, a radiotelephone, etc.), alaptop computer, a tablet computer, a handheld computer, a gamingdevice, a wearable communication device (e.g., a smart wristwatch, apair of smart eyeglasses, etc.), a desktop computer, or a similar typeof device. In some implementations, client device 510 may provide, todevice analytics platform 530, information related to causing deviceanalytics platform 530 to process operations data of a managed device,as described elsewhere herein.

Server device 520 includes one or more devices capable of receiving,generating storing, processing, and/or providing data associated withoperations of a set of managed devices. For example, server device 520may include a server (e.g., in a data center or a cloud computingenvironment), a data center (e.g., a multi-server micro datacenter), aworkstation computer, a virtual machine (VM) provided in a cloudcomputing environment, or a similar type of device. In someimplementations, server device 520 may include a communication interfacethat allows server device 520 to receive information from and/ortransmit information to other devices in environment 500. In someimplementations, server device 520 may be a physical device implementedwithin a housing, such as a chassis. In some implementations, serverdevice 520 may be a virtual device implemented by one or more computerdevices of a cloud computing environment or a data center. In someimplementations, server device 520 may provide, to device analyticsplatform 530, operations data to be processed by device analyticsplatform 530, as described elsewhere herein.

Device analytics platform 530 includes one or more devices capable ofreceiving, generating, storing, processing, and/or providing operationsdata associated with a managed device. For example, device analyticsplatform 530 may include a cloud server or a group of cloud servers. Insome implementations, device analytics platform 530 may be designed tobe modular such that certain software components can be swapped in orout depending on a particular need. As such, device analytics platform530 may be easily and/or quickly reconfigured for different uses.

In some implementations, as shown in FIG. 5, device analytics platform530 may be hosted in cloud computing environment 532. Notably, whileimplementations described herein describe device analytics platform 530as being hosted in cloud computing environment 532, in someimplementations, device analytics platform 530 may be non-cloud-based(i.e., may be implemented outside of a cloud computing environment) ormay be partially cloud-based.

Cloud computing environment 532 includes an environment that hostsdevice analytics platform 530. Cloud computing environment 532 mayprovide computation, software, data access, storage, and/or otherservices that do not require end-user knowledge of a physical locationand configuration of a system and/or a device that hosts deviceanalytics platform 530. As shown, cloud computing environment 532 mayinclude a group of computing resources 534 (referred to collectively as“computing resources 534” and individually as “computing resource 534”).

Computing resource 534 includes one or more personal computers,workstation computers, server devices, or another type of computationand/or communication device. In some implementations, computing resource534 may host device analytics platform 530. The cloud resources mayinclude compute instances executing in computing resource 534, storagedevices provided in computing resource 534, data transfer devicesprovided by computing resource 534, etc. In some implementations,computing resource 534 may communicate with other computing resources534 via wired connections, wireless connections, or a combination ofwired and wireless connections.

As further shown in FIG. 5, computing resource 534 may include a groupof cloud resources, such as one or more applications (“APPs”) 534-1, oneor more virtual machines (“VMs”) 534-2, one or more virtualized storages(“VSs”) 534-3, or one or more hypervisors (“HYPs”) 534-4.

Application 534-1 includes one or more software applications that may beprovided to or accessed by one or more devices of environment 500.Application 534-1 may eliminate a need to install and execute thesoftware applications on devices of environment 500. For example,application 534-1 may include software associated with device analyticsplatform 530 and/or any other software capable of being provided viacloud computing environment 532. In some implementations, oneapplication 534-1 may send/receive information to/from one or more otherapplications 534-1, via virtual machine 534-2. In some implementations,application 534-1 may include a software application associated with oneor more databases and/or operating systems. For example, application534-1 may include an enterprise application, a functional application,an analytics application, and/or the like.

Virtual machine 534-2 includes a software implementation of a machine(e.g., a computer) that executes programs like a physical machine.Virtual machine 534-2 may be either a system virtual machine or aprocess virtual machine, depending upon use and degree of correspondenceto any real machine by virtual machine 534-2. A system virtual machinemay provide a complete system platform that supports execution of acomplete operating system (“OS”). A process virtual machine may executea single program, and may support a single process. In someimplementations, virtual machine 534-2 may execute on behalf of a user(e.g., a user of client device 510), and may manage infrastructure ofcloud computing environment 532, such as data management,synchronization, or long-duration data transfers.

Virtualized storage 534-3 includes one or more storage systems and/orone or more devices that use virtualization techniques within thestorage systems or devices of computing resource 534. In someimplementations, within the context of a storage system, types ofvirtualizations may include block virtualization and filevirtualization. Block virtualization may refer to abstraction (orseparation) of logical storage from physical storage so that the storagesystem may be accessed without regard to physical storage orheterogeneous structure. The separation may permit administrators of thestorage system flexibility in how the administrators manage storage forend users. File virtualization may eliminate dependencies between dataaccessed at a file level and a location where files are physicallystored. This may enable optimization of storage use, serverconsolidation, and/or performance of non-disruptive file migrations.

Hypervisor 534-4 provides hardware virtualization techniques that allowmultiple operating systems (e.g., “guest operating systems”) to executeconcurrently on a host computer, such as computing resource 534.Hypervisor 534-4 may present a virtual operating platform to the guestoperating systems, and may manage the execution of the guest operatingsystems. Multiple instances of a variety of operating systems may sharevirtualized hardware resources.

Device monitoring system 540 includes one or more devices capable ofreceiving, generating, storing, processing, and/or providing operationsdata associated with a managed device. For example, device monitoringsystem 540 may include an infrastructure monitoring system, a monitoringsystem, or a similar type of system. In some implementations, devicemonitoring system 540 may provide, to device analytics platform 530, analert generated by device monitoring system 540 related to operations ofa managed device, as described elsewhere herein.

Network 550 includes one or more wired and/or wireless networks. Forexample, network 550 may include a cellular network (e.g., a long-termevolution (LTE) network, a code division multiple access (CDMA) network,a 3G network, a 4G network, a 5G network, another type of nextgeneration network, etc.), a public land mobile network (PLMN), a localarea network (LAN), a wide area network (WAN), a metropolitan areanetwork (MAN), a telephone network (e.g., the Public Switched TelephoneNetwork (PSTN)), a private network, an ad hoc network, an intranet, theInternet, a fiber optic-based network, a cloud computing network, or thelike, and/or a combination of these or other types of networks.

The number and arrangement of devices and networks shown in FIG. 5 areprovided as an example. In practice, there may be additional devicesand/or networks, fewer devices and/or networks, different devices and/ornetworks, or differently arranged devices and/or networks than thoseshown in FIG. 5. Furthermore, two or more devices shown in FIG. 5 may beimplemented within a single device, or a single device shown in FIG. 5may be implemented as multiple, distributed devices. Additionally, oralternatively, a set of devices (e.g., one or more devices) ofenvironment 500 may perform one or more functions described as beingperformed by another set of devices of environment 500.

FIG. 6 is a diagram of example components of a device 600. Device 600may correspond to client device 510, server device 520, device analyticsplatform 530, computing resource 534, and/or device monitoring system540. In some implementations, client device 510, server device 520,device analytics platform 530, computing resource 534, and/or devicemonitoring system 540 may include one or more devices 600 and/or one ormore components of device 600. As shown in FIG. 6, device 600 mayinclude a bus 610, a processor 620, a memory 630, a storage component640, an input component 650, an output component 660, and acommunication interface 670.

Bus 610 includes a component that permits communication among thecomponents of device 600. Processor 620 is implemented in hardware,firmware, or a combination of hardware and software. Processor 620 is acentral processing unit (CPU), a graphics processing unit (GPU), anaccelerated processing unit (APU), a microprocessor, a microcontroller,a digital signal processor (DSP), a field-programmable gate array(FPGA), an application-specific integrated circuit (ASIC), or anothertype of processing component. In some implementations, processor 620includes one or more processors capable of being programmed to perform afunction. Memory 630 includes a random access memory (RAM), a read onlymemory (ROM), and/or another type of dynamic or static storage device(e.g., a flash memory, a magnetic memory, and/or an optical memory) thatstores information and/or instructions for use by processor 620.

Storage component 640 stores information and/or software related to theoperation and use of device 600. For example, storage component 640 mayinclude a hard disk (e.g., a magnetic disk, an optical disk, amagneto-optic disk, and/or a solid state disk), a compact disc (CD), adigital versatile disc (DVD), a floppy disk, a cartridge, a magnetictape, and/or another type of non-transitory computer-readable medium,along with a corresponding drive.

Input component 650 includes a component that permits device 600 toreceive information, such as via user input (e.g., a touch screendisplay, a keyboard, a keypad, a mouse, a button, a switch, and/or amicrophone). Additionally, or alternatively, input component 650 mayinclude a sensor for sensing information (e.g., a global positioningsystem (GPS) component, an accelerometer, a gyroscope, and/or anactuator). Output component 660 includes a component that providesoutput information from device 600 (e.g., a display, a speaker, and/orone or more light-emitting diodes (LEDs)).

Communication interface 670 includes a transceiver-like component (e.g.,a transceiver and/or a separate receiver and transmitter) that enablesdevice 600 to communicate with other devices, such as via a wiredconnection, a wireless connection, or a combination of wired andwireless connections. Communication interface 670 may permit device 600to receive information from another device and/or provide information toanother device. For example, communication interface 670 may include anEthernet interface, an optical interface, a coaxial interface, aninfrared interface, a radio frequency (RF) interface, a universal serialbus (USB) interface, a Wi-Fi interface, a cellular network interface, orthe like.

Device 600 may perform one or more processes described herein. Device600 may perform these processes based on to processor 620 executingsoftware instructions stored by a non-transitory computer-readablemedium, such as memory 630 and/or storage component 640. Acomputer-readable medium is defined herein as a non-transitory memorydevice. A memory device includes memory space within a single physicalstorage device or memory space spread across multiple physical storagedevices.

Software instructions may be read into memory 630 and/or storagecomponent 640 from another computer-readable medium or from anotherdevice via communication interface 670. When executed, softwareinstructions stored in memory 630 and/or storage component 640 may causeprocessor 620 to perform one or more processes described herein.Additionally, or alternatively, hardwired circuitry may be used in placeof or in combination with software instructions to perform one or moreprocesses described herein. Thus, implementations described herein arenot limited to any specific combination of hardware circuitry andsoftware.

The number and arrangement of components shown in FIG. 6 are provided asan example. In practice, device 600 may include additional components,fewer components, different components, or differently arrangedcomponents than those shown in FIG. 6. Additionally, or alternatively, aset of components (e.g., one or more components) of device 600 mayperform one or more functions described as being performed by anotherset of components of device 600.

FIG. 7 is a flow chart of an example process 700 for analyzingdevice-related data to generate and/or suppress device-related alerts.In some implementations, one or more process blocks of FIG. 7 may beperformed by a device analytics platform (e.g., device analyticsplatform 530). In some implementations, one or more process blocks ofFIG. 7 may be performed by another device or a group of devices separatefrom or including the device analytics platform, such as a client device(e.g., client device 510), a server device (e.g., server device 520), acomputing resource (e.g., computing resource 534), a device monitoringsystem (e.g., device monitoring system 540), and/or the like.

As shown in FIG. 7, process 700 may include receiving an indication ofat least one alert related to operations of a plurality of manageddevices and data related to the operations of the plurality of manageddevices, wherein the indication of the at least one alert is receivedfrom a monitoring system that is monitoring the operations of theplurality of managed devices (block 710). For example, the deviceanalytics platform (e.g., using computing resource 534, processor 620,input component 650, communication interface 670, and/or the like) mayreceive an indication of at least one alert related to operations of aplurality of managed devices and data related to the operations of theplurality of managed devices, as described above. In someimplementations, the indication of at least one alert is received from amonitoring system that is monitoring the operations of the plurality ofmanaged devices.

As further shown in FIG. 7, process 700 may include determining, afterreceiving the data, a multi-entity profile for the data, wherein themulti-entity profile includes a set of groupings of the data by one ormore attributes of the plurality of managed devices (block 720). Forexample, the device analytics platform (e.g., using computing resource534, processor 620, and/or the like) may determine, after receiving thedata, a multi-entity profile for the data, as described above. In someimplementations, the multi-entity profile includes a set of groupings ofthe data by one or more attributes of the plurality of managed devices.

As further shown in FIG. 7, process 700 may include determining, usingthe multi-entity profile, a set of sub-models for the data afterdetermining the multi-entity profile, wherein at least one sub-model, ofthe set of sub-models, is associated with contextualizing the data tothe plurality of managed devices (block 730). For example, the deviceanalytics platform (e.g., using computing resource 534, processor 620,and/or the like) may determine, using the multi-entity profile, a set ofsub-models for the data after determining the multi-entity profile, asdescribed above. In some implementations, at least one sub-model, of theset of sub-models, is associated with contextualizing the data to theplurality of managed devices.

As further shown in FIG. 7, process 700 may include generating a modelbased on the set of sub-models (block 740). For example, the deviceanalytics platform (e.g., using computing resource 534, processor 620,and/or the like) may generate a model based on the set of sub-models, asdescribed above.

As further shown in FIG. 7, process 700 may include determining,utilizing the model after generating the model, respective scores forthe plurality of managed devices, wherein the respective scores are usedto identify at least one of: one or more alerts, of the at least onealert, to suppress, or one or more managed devices, of the plurality ofmanaged devices, to replace (block 750). For example, the deviceanalytics platform (e.g., using computing resource 534, processor 620,and/or the like) may determine, utilizing the model after generating themodel, respective scores for the plurality of managed devices, asdescribed above. In some implementations, the respective scores are usedto identify at least one of: one or more alerts, of the at least onealert, to suppress, or one or more managed devices, of the plurality ofmanaged devices, to replace.

As further shown in FIG. 7, process 700 may include performing one ormore actions related to at least one of the plurality of managed devicesand the at least one alert after determining the respective scores forthe plurality of managed devices (block 760). For example, the deviceanalytics platform (e.g., using computing resource 534, processor 620,memory 630, storage component 640, output component 660, communicationinterface 670, and/or the like) may perform one or more actions relatedto at least one of the plurality of managed devices and the at least onealert after determining the respective scores for the plurality ofmanaged devices, as described above.

Process 700 may include additional implementations, such as any singleimplementation or any combination of implementations described belowand/or in connection with one or more other processes describedelsewhere herein.

In some implementations, the plurality of managed devices includes aplurality of network devices. In some implementations, the deviceanalytics platform may process the multi-entity profile using a kerneldensity estimation (KDE) model after determining the multi-entityprofile; and may determine a set of metric sub-models, of the set ofsub-models, based on processing the multi-entity profile using the KDEmodel.

In some implementations, the device analytics platform may group theplurality of managed devices based on the one or more attributes of theplurality of managed devices after determining the multi-entity profile,or may generate a multivariate metric model for the plurality of manageddevices after determining the multi-entity profile; and may determine aset of device sub-models, of the set of sub-models, after grouping theplurality of managed devices or based on the multivariate metric model.In some implementations, the device analytics platform may generate, asthe model, at least one of: an isolation forest, or a neural network;and may determine the respective scores utilizing the at least one ofthe isolation forest or the neural network.

In some implementations, the device analytics platform may determine themulti-entity profile based on at least one of: respective types of theplurality of managed devices, respective ages of the plurality ofmanaged devices, or respective locations of the plurality of manageddevices. In some implementations, the device analytics platform maydetermine respective qualities of the operations of the plurality ofmanaged devices based on the respective scores for the plurality ofmanaged devices; and may prevent the one or more alerts from being sentto a client device associated with managing the plurality of manageddevices, to suppress the alert; and may provide a message, for display,that identifies that the alert was suppressed.

Although FIG. 7 shows example blocks of process 700, in someimplementations, process 700 may include additional blocks, fewerblocks, different blocks, or differently arranged blocks than thosedepicted in FIG. 7. Additionally, or alternatively, two or more of theblocks of process 700 may be performed in parallel.

FIG. 8 is a flow chart of an example process 800 for analyzingdevice-related data to generate and/or suppress device-related alerts.In some implementations, one or more process blocks of FIG. 8 may beperformed by a device analytics platform (e.g., device analyticsplatform 530). In some implementations, one or more process blocks ofFIG. 8 may be performed by another device or a group of devices separatefrom or including the device analytics platform, such as a client device(e.g., client device 510), a server device (e.g., server device 520), acomputing resource (e.g., computing resource 534), a device monitoringsystem (e.g., device monitoring system 540), and/or the like.

As shown in FIG. 8, process 800 may include receiving at least one alertrelated to operations of a plurality of managed devices and data relatedto the operations of the plurality of managed devices, wherein the atleast one alert is received from a device monitoring system associatedwith the plurality of managed devices, and wherein the data related tothe operations is received from the plurality of managed devices (block810). For example, the device analytics platform (e.g., using computingresource 534, processor 620, communication interface 670, and/or thelike) may receive at least one alert related to operations of aplurality of managed devices and data related to the operations of theplurality of managed devices, as described above. In someimplementations, the at least one alert is received from a devicemonitoring system associated with the plurality of managed devices. Insome implementations, the data related to the operations is receivedfrom the plurality of managed devices.

As further shown in FIG. 8, process 800 may include determining, afterreceiving the data, a multi-entity profile for the data based on one ormore attributes of the plurality of managed devices (block 820). Forexample, the device analytics platform (e.g., using computing resource534, processor 620, and/or the like) may determine, after receiving thedata, a multi-entity profile for the data based on one or moreattributes of the plurality of managed devices, as described above.

As further shown in FIG. 8, process 800 may include determining, usingthe multi-entity profile, a set of sub-models for the data related tothe operations after determining the multi-entity profile, wherein theset of sub-models is associated with processing the data in acontextualized manner (block 830). For example, the device analyticsplatform (e.g., using computing resource 534, processor 620, and/or thelike) may determine, using the multi-entity profile, a set of sub-modelsfor the data related to the operations after determining themulti-entity profile, as described above. In some implementations, theset of sub-models is associated with processing the data in acontextualized manner.

As further shown in FIG. 8, process 800 may include generating a modelbased on the set of sub-models, wherein the model is associated withidentifying at least one of: one or more alerts, of the at least onealert, to suppress, or one or more managed devices, of the plurality ofmanaged devices, to replace (block 840). For example, the deviceanalytics platform (e.g., using computing resource 534, processor 620,and/or the like) may generate a model based on the set of sub-models, asdescribed above. In some implementations, the model is associated withidentifying at least one of: one or more alerts, of the at least onealert, to suppress, or one or more managed devices, of the plurality ofmanaged devices, to replace.

As further shown in FIG. 8, process 800 may include performing one ormore actions related to the plurality of managed devices or the at leastone alert after determining respective scores for the operations (block850). For example, the device analytics platform (e.g., using computingresource 534, processor 620, memory 630, storage component 640, outputcomponent 660, communication interface 670, and/or the like) may performone or more actions related to the plurality of managed devices or theat least one alert after determining respective scores for theoperations, as described above.

Process 800 may include additional implementations, such as any singleimplementation or any combination of implementations described herein,and/or in connection with one or more other processes describedelsewhere herein.

In some implementations, the device analytics platform may determine,utilizing the model after generating the model, the respective scoresfor the operations of the plurality of managed devices, wherein therespective scores indicate respective qualities of the operations of theplurality of managed devices; and may generate a recommendation tosuppress the one or more alerts based on the respective scores. In someimplementations, the device analytics platform may determine, based onthe respective scores after determining the respective scores, that theone or more managed devices, of the plurality of managed devices, needto be replaced; and may generate a work order related to replacing theone or more managed devices after determining that the one or moremanaged devices need to be replaced.

In some implementations, the device analytics platform may generate themodel based on combining a set of metric sub-models, of the set ofsub-models, and a set of device sub-models, of the set of sub-models,into the model. In some implementations, the data related to theoperations of the plurality of managed devices may identify values forat least one of: respective input utilizations for the plurality ofmanaged devices, respective output utilizations for the plurality ofmanaged devices, respective central processing unit (CPU) utilizationsfor the plurality of managed devices, or respective jitters associatedwith communications of the plurality of managed devices.

In some implementations, the device analytics platform may power down afirst managed device, of the plurality of managed devices, based on afirst score, of the respective scores, for the first managed device; andmay power on a second managed device, of the plurality of manageddevices, in association with powering down the first device based on thefirst score. In some implementations, the multi-entity profile includesa set of groupings of the data related to the operations by the one ormore attributes of the plurality of managed devices.

Although FIG. 8 shows example blocks of process 800, in someimplementations, process 800 may include additional blocks, fewerblocks, different blocks, or differently arranged blocks than thosedepicted in FIG. 8. Additionally, or alternatively, two or more of theblocks of process 800 may be performed in parallel.

FIG. 9 is a flow chart of an example process 900 for analyzingdevice-related data to generate and/or suppress device-related alerts.In some implementations, one or more process blocks of FIG. 9 may beperformed by a device analytics platform (e.g., device analyticsplatform 530). In some implementations, one or more process blocks ofFIG. 9 may be performed by another device or a group of devices separatefrom or including the device analytics platform, such as a client device(e.g., client device 510), a server device (e.g., server device 520), acomputing resource (e.g., computing resource 534), a device monitoringsystem (e.g., device monitoring system 540), and/or the like.

As shown in FIG. 9, process 900 may include receiving data related to aplurality of managed devices, wherein the data includes at least one of:diagnostic data associated with operations of the plurality of manageddevices, call dispatch data associated with respective service historiesassociated with the plurality of managed devices, or customer dataassociated with respective customers associated with the plurality ofmanaged devices (block 910). For example, the device analytics platform(e.g., using computing resource 534, processor 620, communicationinterface 670, and/or the like) may receive data related to a pluralityof managed devices, as described above. In some implementations, thedata includes at least one of: diagnostic data associated withoperations of the plurality of managed devices, call dispatch dataassociated with respective service histories associated with theplurality of managed devices, or customer data associated withrespective customers associated with the plurality of managed devices.

As further shown in FIG. 9, process 900 may include determining, afterreceiving the data, a multi-entity profile for the data, wherein themulti-entity profile includes a set of groupings of the data by one ormore attributes of the plurality of managed devices (block 920). Forexample, the device analytics platform (e.g., using computing resource534, processor 620, and/or the like) may determine, after receiving thedata, a multi-entity profile for the data, as described above. In someimplementations, the multi-entity profile includes a set of groupings ofthe data by one or more attributes of the plurality of managed devices.

As further shown in FIG. 9, process 900 may include determining, usingthe multi-entity profile, a set of sub-models for the data afterdetermining the multi-entity profile, wherein the set of sub-models isassociated with processing the data in a contextualized manner (block930). For example, the device analytics platform (e.g., using computingresource 534, processor 620, and/or the like) may determine, using themulti-entity profile, a set of sub-models for the data after determiningthe multi-entity profile, as described above. In some implementations,the set of sub-models is associated with processing the data in acontextualized manner.

As further shown in FIG. 9, process 900 may include generating a modelbased on the set of sub-models (block 940). For example, the deviceanalytics platform (e.g., using computing resource 534, processor 620,and/or the like) may generate a model based on the set of sub-models, asdescribed above.

As further shown in FIG. 9, process 900 may include performing, aftergenerating the model, one or more actions related to the plurality ofmanaged devices based on respective scores associated with the pluralityof managed devices (block 950). For example, the device analyticsplatform (e.g., using computing resource 534, processor 620, memory 630,storage component 640, output component 660, communication interface670, and/or the like) may perform one or more actions related to theplurality of managed devices based on respective scores associated withthe plurality of managed devices after generating the model, asdescribed above.

Process 900 may include additional implementations, such as any singleimplementation or any combination of implementations described hereinand/or in connection with one or more other processes described herein.

In some implementations, the device analytics platform may determine,from the data, the respective service histories of the plurality ofmanaged devices after receiving the data. In some implementations, thedevice analytics platform may determine, utilizing the model, therespective scores for the plurality of managed devices, wherein therespective scores indicate respective qualities of the operations of theplurality of managed devices based on the respective service histories.

In some implementations, the device analytics platform may receive aservice request telephone call related to a managed device of theplurality of managed devices; and may determine a priority for theservice request telephone call based on a score, of the respectivescores, associated with the operations of the managed device. In someimplementations, the device analytics platform may transfer, based onthe priority, the service request telephone call to at least one of: atelephone associated with a customer service representative, or aninteractive voice response (IVR) system. In some implementations, thedevice analytics platform may send a message to a network technician todispatch the network technician to a location of the managed deviceassociated with the service request telephone call based on thepriority.

Although FIG. 9 shows example blocks of process 900, in someimplementations process 900 may include additional blocks, fewer blocks,different blocks, or differently arranged blocks than those depicted inFIG. 9. Additionally, or alternatively, two or more of the blocks ofprocess 900 may be performed in parallel.

The foregoing disclosure provides illustration and description, but isnot intended to be exhaustive or to limit the implementations to theprecise form disclosed. Modifications and variations may be made inlight of the above disclosure or may be acquired from practice of theimplementations.

As used herein, the term “component” is intended to be broadly construedas hardware, firmware, and/or a combination of hardware and software.

Some implementations are described herein in connection with thresholds.As used herein, satisfying a threshold may refer to a value beinggreater than the threshold, more than the threshold, higher than thethreshold, greater than or equal to the threshold, less than thethreshold, fewer than the threshold, lower than the threshold, less thanor equal to the threshold, equal to the threshold, depending on thecontext.

It will be apparent that systems and/or methods, described herein, maybe implemented in different forms of hardware, firmware, or acombination of hardware and software. The actual specialized controlhardware or software code used to implement these systems and/or methodsis not limiting of the implementations. Thus, the operation and behaviorof the systems and/or methods were described herein without reference tospecific software code—it being understood that software and hardwarecan be designed to implement the systems and/or methods based on thedescription herein.

Even though particular combinations of features are recited in theclaims and/or disclosed in the specification, these combinations are notintended to limit the disclosure of various implementations. In fact,many of these features may be combined in ways not specifically recitedin the claims and/or disclosed in the specification. Although eachdependent claim listed below may directly depend on only one claim, thedisclosure of various implementations includes each dependent claim incombination with every other claim in the claim set.

No element, act, or instruction used herein should be construed ascritical or essential unless explicitly described as such. Also, as usedherein, the articles “a” and “an” are intended to include one or moreitems, and may be used interchangeably with “one or more.” Furthermore,as used herein, the term “set” is intended to include one or more items(e.g., related items, unrelated items, a combination of related andunrelated items, etc.), and may be used interchangeably with “one ormore.” Where only one item is intended, the phrase “only one” or similarlanguage is used. Also, as used herein, the terms “has,” “have,”“having,” or the like are intended to be open-ended terms. Further, thephrase “based on” is intended to mean “based, at least in part, on”unless explicitly stated otherwise.

What is claimed is:
 1. A method, comprising: receiving, by a device, anindication of at least one alert related to operations of a plurality ofmanaged devices and data related to the operations of the plurality ofmanaged devices, wherein the indication of the at least one alert isreceived from a monitoring system that is monitoring the operations ofthe plurality of managed devices; determining, by the device and afterreceiving the data, a multi-entity profile for the data, wherein themulti-entity profile includes a set of groupings of the data by one ormore attributes of the plurality of managed devices; determining, by thedevice and using the multi-entity profile, a set of sub-models for thedata after determining the multi-entity profile, wherein at least onesub-model, of the set of sub-models, is associated with contextualizingthe data to the plurality of managed devices; generating, by the device,a model based on the set of sub-models; determining, by the device andutilizing the model after generating the model, respective scores forthe plurality of managed devices, wherein the respective scores are usedto identify at least one of: one or more alerts, of the at least onealert, to suppress, or one or more managed devices, of the plurality ofmanaged devices, to replace; and performing, by the device, one or moreactions related to at least one of the plurality of managed devices andthe at least one alert after determining the respective scores for theplurality of managed devices.
 2. The method of claim 1, wherein theplurality of managed devices includes a plurality of network devices. 3.The method of claim 1, further comprising: processing the multi-entityprofile using a kernel density estimation (KDE) model after determiningthe multi-entity profile; and wherein determining the set of sub-modelscomprises: determining a set of metric sub-models, of the set ofsub-models, based on processing the multi-entity profile using the KDEmodel.
 4. The method of claim 1, further comprising: grouping theplurality of managed devices based on the one or more attributes of theplurality of managed devices after determining the multi-entity profile,or generating a multivariate metric model for the plurality of manageddevices after determining the multi-entity profile; and whereindetermining the set of sub-models comprises: determining a set of devicesub-models, of the set of sub-models, after grouping the plurality ofmanaged devices or based on the multivariate metric model.
 5. The methodof claim 1, wherein generating the model comprises: generating, as themodel, at least one of: an isolation forest, or a neural network; andwherein determining the respective scores comprises: determining therespective scores utilizing the at least one of the isolation forest orthe neural network.
 6. The method of claim 1, wherein determining themulti-entity profile comprises: determining the multi-entity profilebased on at least one of: respective types of the plurality of manageddevices, respective ages of the plurality of managed devices, orrespective locations of the plurality of managed devices.
 7. The methodof claim 1, further comprising: determining respective qualities of theoperations of the plurality of managed devices based on the respectivescores for the plurality of managed devices; and wherein performing theone or more actions comprises: preventing the one or more alerts frombeing sent to a client device associated with managing the plurality ofmanaged devices, to suppress the alert; and providing a message, fordisplay via a display, that identifies that the alert was suppressed. 8.A device, comprising: one or more memories; and one or more processors,communicatively coupled to the one or more memories, to: receive atleast one alert related to operations of a plurality of managed devicesand data related to the operations of the plurality of managed devices,wherein the at least one alert is received from a device monitoringsystem associated with the plurality of managed devices, and wherein thedata related to the operations is received from the plurality of manageddevices; determine, after receiving the data, a multi-entity profile forthe data based on one or more attributes of the plurality of manageddevices; determine, using the multi-entity profile, a set of sub-modelsfor the data related to the operations after determining themulti-entity profile, wherein the set of sub-models is associated withprocessing the data in a contextualized manner; generate a model basedon the set of sub-models, wherein the model is associated withidentifying at least one of: one or more alerts, of the at least onealert, to suppress, or one or more managed devices, of the plurality ofmanaged devices, to replace; and perform one or more actions related tothe plurality of managed devices or the at least one alert afterdetermining respective scores for the operations.
 9. The device of claim8, wherein the one or more processors are further to: determine,utilizing the model after generating the model, the respective scoresfor the operations of the plurality of managed devices, wherein therespective scores indicate respective qualities of the operations of theplurality of managed devices; and wherein the one or more processors,when performing the one or more actions, are to: generate arecommendation to suppress the one or more alerts based on therespective scores.
 10. The device of claim 9, wherein the one or moreprocessors, when performing the one or more actions, are to: determine,based on the respective scores after determining the respective scores,that the one or more managed devices, of the plurality of manageddevices, need to be replaced; and generate a work order related toreplacing the one or more managed devices after determining that the oneor more managed devices need to be replaced.
 11. The device of claim 8,wherein the one or more processors, when generating the model, are to:generate the model based on combining a set of metric sub-models, of theset of sub-models, and a set of device sub-models, of the set ofsub-models, into the model.
 12. The device of claim 8, wherein the datarelated to the operations of the plurality of managed devices identifiesvalues for at least one of: respective input utilizations for theplurality of managed devices, respective output utilizations for theplurality of managed devices, respective central processing unit (CPU)utilizations for the plurality of managed devices, or respective jittersassociated with communications of the plurality of managed devices. 13.The device of claim 8, wherein the one or more processors, whenperforming the one or more actions, are to: power down a first manageddevice, of the plurality of managed devices, based on a first score, ofthe respective scores, for the first managed device; and power on asecond managed device, of the plurality of managed devices, afterpowering down the first managed device based on the first score.
 14. Thedevice of claim 8, wherein the multi-entity profile includes a set ofgroupings of the data related to the operations by the one or moreattributes of the plurality of managed devices.
 15. A non-transitorycomputer-readable medium storing instructions, the instructionscomprising: one or more instructions that, when executed by one or moreprocessors, cause the one or more processors to: receive data related toa plurality of managed devices, wherein the data includes at least oneof: diagnostic data associated with operations of the plurality ofmanaged devices, call dispatch data associated with respective servicehistories associated with the plurality of managed devices, or customerdata associated with respective customers associated with the pluralityof managed devices; determine, after receiving the data, a multi-entityprofile for the data, wherein the multi-entity profile includes a set ofgroupings of the data by one or more attributes of the plurality ofmanaged devices; determine, using the multi-entity profile, a set ofsub-models for the data after determining the multi-entity profile,wherein the set of sub-models is associated with processing the data ina contextualized manner; generate a model based on the set ofsub-models; and perform, after generating the model, one or more actionsrelated to the plurality of managed devices based on respective scoresassociated with the plurality of managed devices.
 16. The non-transitorycomputer-readable medium of claim 15, wherein the one or moreinstructions, when executed by the one or more processors, further causethe one or more processors to: determine, from the data, the respectiveservice histories of the plurality of managed devices after receivingthe data.
 17. The non-transitory computer-readable medium of claim 16,wherein the one or more instructions, when executed by the one or moreprocessors, cause the one or more processors to: determine, utilizingthe model, the respective scores for the plurality of managed devices,wherein the respective scores indicate respective qualities of theoperations of the plurality of managed devices based on the respectiveservice histories.
 18. The non-transitory computer-readable medium ofclaim 15, wherein the one or more instructions, when executed by the oneor more processors, further cause the one or more processors to: receivea service request telephone call related to a managed device of theplurality of managed devices; and wherein the one or more instructions,that cause the one or more processors to perform the one or moreactions, cause the one or more processors to: determine a priority forthe service request telephone call based on a score, of the respectivescores, associated with the operations of the managed device.
 19. Thenon-transitory computer-readable medium of claim 18, wherein the one ormore instructions, that cause the one or more processors to perform theone or more actions, cause the one or more processors to: transfer,based on the priority, the service request telephone call to at leastone of: a telephone associated with a customer service representative,or an interactive voice response (IVR) system.
 20. The non-transitorycomputer-readable medium of claim 18, wherein the one or moreinstructions, that cause the one or more processors to perform the oneor more actions, cause the one or more processors to: send a message toa network technician to dispatch the network technician to a location ofthe managed device associated with the service request telephone callbased on the priority.